Post Office Protocol (POP3)

1. The Role of POP3 in the Email Ecosystem

Post Office Protocol version 3 (POP3) is an application protocol for retrieving electronic mail from a server. The Simple Mail Transfer Protocol (SMTP) moves a message from the sender to the recipient's mail server, while POP3 gives a client access to messages stored in the mailbox.

POP3 uses a client-server model. An email client application, known as a , connects to a mail server and downloads messages from a user's mailbox. The protocol was designed as a simple mechanism for transferring mail to a local client.

2. Core Characteristics of POP3

The design and behavior of POP3 follow a simple model for accessing messages stored on a server.

POP3 is a text protocol carried in a TCP session. The client sends commands terminated by CRLF, and the server returns a status; multiline responses end with a line containing a single period. STAT, LIST, and RETR respectively report mailbox totals, message sizes, and message content. DELE only marks a message in the transaction state; permanent removal occurs during QUIT. RSET can undo deletion marks in the current session. UIDL helps a client recognize messages across sessions, but it does not synchronize folders or read state. The server signals success with +OK and failure with -ERR, while optional extensions may add commands.

Simple Download-and-Delete Workflow
A typical POP3 workflow downloads messages to a local device (your computer's hard drive) and optionally marks them for deletion. The protocol does not require deletion: a client can leave a copy on the server. When the client sends DELE and ends the session with QUIT, the local copy remains and the message is removed from the maildrop according to the server's operation.
Designed for a Single Client
POP3 fits access from one primary client, especially with a download-and-delete workflow. With multiple devices, leaving copies on the server does not synchronize message state. If a phone downloads messages and the client removes them, a laptop cannot download them again. This lack of synchronization is a major limitation of POP3.
Offline Access as a Primary Feature
Once messages have been downloaded, a client can make them available offline. You can then read, reply to, delete, and organize mail without an active internet connection. Queuing replies and sending them when the client reconnects depend on the mail application.
Minimal Server Storage Requirements
In a download-and-delete workflow, the server may retain less data after a session, so storage requirements are lower. If a client leaves copies on the server, this benefit does not apply. Lower storage requirements were especially relevant when server storage was expensive in the early days of the internet.
Designated Communication Ports
POP3 uses standardized network ports to listen for client connections:
- Port 110: The standard POP3 port. Without TLS, communication, including the password, is sent in clear text; the server may also support the STLS command, which starts TLS negotiation.
- Port 995: The standard port for POP3 with implicit TLS, often called POP3S. TLS negotiation starts when the connection is established and protects credentials and message content.

3. The Three States of a POP3 Session

A POP3 session is a structured, stateful process that progresses through three distinct phases.

The AUTHORIZATION State
This is the initial phase where the client authenticates to the server. Maildrop operations require successful authentication. After authentication, the server acquires an exclusive lock on the mailbox to prevent simultaneous modifications.
The TRANSACTION State
Once authorized, the session enters the transaction state. Here, the client can issue commands to interact with the mailbox. The client can list messages, retrieve messages, and mark messages for deletion. All actions in this phase, including marking for deletion, are reversible until the session enters the final state.
The UPDATE State
The session transitions to the update state when the client sends 'QUIT' from the transaction state. The server removes messages marked with DELE, releases the maildrop lock, and closes the TCP connection. If the connection breaks before 'QUIT', the session does not enter the update state, so messages marked for deletion are not removed.

4. A Detailed POP3 Command Walkthrough

The communication in POP3 is a simple command-and-response dialogue. The server's responses are straightforward: '+OK' for a successful command, and '-ERR' for an error.

Phase 1: Authorization

Client connects via TCP to the server on port 110.

Server sends a greeting.

Server: +OK POP3 server ready <1896.697170952@mail.example.com>

Client sends username.
```
Client: USER johndoe
```
Server acknowledges.
```
Server: +OK
```
Client sends password.
```
Client: PASS a-very-secure-password
```

Server authenticates and locks the mailbox.

Server: +OK johndoe's maildrop has 2 messages (320 octets)

Phase 2: Transaction

Client checks the status of the mailbox.
```
Client: STAT
```
```
Server: +OK 2 320
```

Client lists the messages to get their numbers and sizes.

Client: LIST

Server: +OK 2 messages (320 octets)
Server: 1 120
Server: 2 200
Server: .

Client retrieves the first message.

Client: RETR 1

Server: +OK 120 octets
Server: (the server sends the full content of message 1)
Server: .

After successfully downloading message 1, the client marks it for deletion.
```
Client: DELE 1
```
```
Server: +OK message 1 deleted
```
Client repeats for the second message.
```
Client: RETR 2
...
Client: DELE 2
```

Phase 3: Update

Having finished its tasks, the client ends the session.
```
Client: QUIT
```
The server now permanently deletes messages 1 and 2, releases the lock, and closes the connection.
```
Server: +OK dewey POP3 server signing off
```

5. Security and the Evolution Beyond POP3

The original POP3 protocol did not encrypt the session. Without TLS, passwords and messages are sent in clear text. Current deployments should use TLS: implicit TLS on port 995 or a TLS upgrade using the STLS command on port 110, according to the server and client configuration. SSL is a historical term here because current configurations use TLS.

The "Leave Mail on Server" Problem

Most modern email clients offer a setting for POP3 accounts called "Leave a copy of messages on server". While this seems to solve the single-device problem, it creates a new set of issues. The protocol itself has no concept of synchronizing the "state" of a message. This means:

If you read an email on your phone, it remains marked as "unread" on your computer.
If you delete an email on your computer, it remains in the inbox on your phone.
Folders created on one device are not visible on any other device.
The "Sent Items" folder is local to the device you used to send the message.

The lack of state synchronization limits POP3 for users with multiple devices. The Internet Message Access Protocol (IMAP) was designed for server-side storage and synchronization between clients, so it supports this usage pattern more directly.